Re: [PATCH] jfs: fix out-of-bounds write in add_missing_indices()

Re: [PATCH] jfs: fix out-of-bounds write in add_missing_indices()

[Wang Yibo]

While looking at the syzbot report this patch was written for, I found
two more open reports that look like the same bug:

  general protection fault in smack_inode_getattr
    https://syzkaller.appspot.com/bug?extid=ce678add490179a73d5a

  general protection fault in smack_inode_permission
    https://syzkaller.appspot.com/bug?extid=fc1d5d9a7ebabbc27458

The second one is still being hit in the current tree, and its console
output has the jfs_readdir() "Dtree error" lines for ino 2 right before
the fault.  Both reports die in smk_of_inode() on a crafted
inode->i_security, and both show the same damage: only the upper 32 bits
of the pointer were replaced, by 0x0000000c, so the low half of the
original pointer is still there.

That is one 4-byte store at i_security + 4.  For the inline dtree root
the slot entries are 32 bytes with the index field at offset 28, so with
_dtroot at 728 and the embedded inode at 1048 in struct jfs_inode_info, a
write to slot[11].index lands on i_security + 4, and the value stored
there is the directory's next_index, 12 in both reports.  The only code
that stores next_index through an unchecked slot index is
add_missing_indices(), when a corrupted stbl[] entry points past the nine
slots the root page has.

I checked this on a SMACK enabled build with the reproducer from the
first report: without the fix it dies in smack_inode_permission from
ksys_umount() with i_security = 0x0000000c27a22900, the same damage as
the two reports above; with the patch the entry is rejected with -EIO and
the directory scan finishes.

So one fix should cover all three reports.  I will add the Closes: tags
for them, and Cc the matching syzbot addresses, in v2 once this version
has been reviewed.

Thanks,
Wang Yibo